Privacy policy

Controller

[Company legal name], [address]. Contact: support@example.com.

What we process and why

Purchase: email, company name (teams), payment status and amount. Card data is handled by Stripe; we never see or store it. Legal basis: contract (Art. 6(1)(b) GDPR) and legal retention duties (Art. 6(1)(c) GDPR).

Training: name, email (if invited by email), language, progress, knowledge-check answers and result, completion date, certificate ID, and your answers to the five work-context questions. Legal basis: contract; for employees invited by their employer, the employer’s legitimate interest in documenting training (Art. 6(1)(f) GDPR).

Your employer (if they invited you) sees your name, email, status, score, completion date and certificate. They do not see your individual answers or your context questionnaire.

Verification page: shows course, date, version and language. Your name only appears if you enabled it. Your email is never shown.

Usage statistics: we count a small number of anonymous funnel events (e.g. “pricing page viewed”) without cookies and without personal identifiers.

Processors

Supabase (database hosting, [EU region]), Vercel (hosting), Stripe (payments), Resend (transactional email). [Add data processing agreements and transfer mechanisms.]

Cookies

We only use strictly necessary cookies to keep you logged in to your training or dashboard. No tracking or advertising cookies.

Retention

Training records and certificates are kept for [X] years so certificates remain verifiable. Purchase data is kept as required by tax law. You can request deletion earlier; the certificate then becomes unverifiable.

Your rights

Access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR), and the right to lodge a complaint with a supervisory authority.